Logpoint Reviews

Logpoint is our SIEM subscription with UEBA, and it has additional features integrated into the platform. We are a DOD contractor and need a tool that can integrate and correlate our security-related data from various sources.

The UEBA component, as well as the SOAR component, are some of the most valuable features of Logpoint. The UEBA enables us to monitor at the device level, and SOAR provides playbooks and templates that we can modify and incorporate into the platform. This capability is highly useful for our organization.

We have a security operations center, and we tailor the use cases to our customer's specific requirements. The majority of use cases focus on protecting against cybersecurity attacks, increasing cybersecurity posture, and defending against security threats. 

The specific use cases depend on the customer's environment. For example, if the customer has a Windows-based solution, we focus on Windows-based use cases. If there are other applications and operating systems, we select relevant use cases accordingly.

Many features enhance the incident response capabilities. Logpoint has an agent, Agent X, which is a kind of EDR that doesn't have its own response capability. The response capability has to come from the central software, the Logpoint SIEM solution. 

However, the agent is capable of executing commands at the user endpoint. That is one thing that enhances the sole capability. The good thing about Logpoint is that it has a built-in SOAR. When our customers purchase Logpoint, they also get a SOAR license. In our case, we see that the SOAR part is very helpful when we create playbooks for any kind of response or incident responses. We get a lot of support from Logpoint to come up with the actual response patterns, response sequences, and all those instances. Along with Agent X, we can execute it very effectively.

The more important thing is the investigation part. Logpoint has integration with some IOCs, which is an easy thing and helps us with a lot of cases. The integration bits, such as threat intelligence or the recorded feature application, give us a good capability to identify threats and come up with proper solutions. 

The recorded feature is an integration, which is a natural integration or which is by default, already integrated with the product. It's also giving us a good kind of capability to respond to incidents as well.

We use LogPoint for log collection. We have a specific use case around a system that was not able to provide this kind of correlation. However, we are going to get rid of the legacy platform within the year and will be moving away from LogPoint.

The most valuable feature is the log creating according to specific rules.

The main purpose was for compliance reasons because the pension funds need to comply with the Dutch Federal Bank rules. So, most of the use cases were much more focused on the separation of duties, privilege escalation, and access to sensitive data.

We were not using it as an active, real-time monitoring tool. The group of people looking after security was very small, and there were only daytime operations. So, the focus was not to look after external breaches, attacks, etc. That's the main reason why the responsibility of security monitoring was not ours anymore. Accountability and responsibility had shifted from the internal organization to a contracting firm.

The most beneficial was being able to prove, with proper reports, that from a compliance perspective, the company is in control. The service part of LogPoint did modifications or did some additional work to have the proper reports defined.

We use it as a repository of most of the logs that are created within our office systems. It is mostly used for forensic purposes. If there is an investigation, we go look for the logs. We find those logs in LogPoint, and then we use them for further analysis.

We have close to 33 different sources of logs, and we were able to onboard most of them in less than three months. Its adoption is very quick, and once you have the logs in there, the ability to search for things is very good.

We do SMB and schools, K through 12. 

We have a storage cloud and cloud-based Cisco voiceover IP cloud services that we offer, as well as on-premise-based for those who still prefer that.

They basically charge you in a better way. Instead of starting to charge you more as you do more data, it is based on the different data modules that you had or items you were monitoring. 

It wasn't as if the flow increases a lot then you could kill, like some other products when you start using it more. It's nice at first and then it gets more expensive. This product was a little bit better on that, on adding users.

It monitors the users as well as the endpoints and provides data for that. It basically studies the activities, tries to understand the activities, and then does a little bit baseline for that. It then monitors the user or the endpoint to see if there is any deviation. If there is any deviation, it triggers an alarm.

It is an AI technology because it is using machine learning technology. So far, there is nothing better out there for UEBA in terms of monitoring endpoints and user activity. It is using machine learning language, so it is right at the top. It provides that capability and monitors all the activities. It devises a baseline and monitors if there is any deviation from the baseline.

I'm using LogPoint as a commercial product. My company uses LogPoint for data aggregation, which is also used for creating custom use cases based on organizational leads. Then, my company triggers and escalates to the IT team responsible for solving loopholes and problems seen via LogPoint.

What I like best about LogPoint is its cost-effectiveness compared to other solutions.

LogPoint also has better dashboards which I find valuable. I also like that you can create use cases based on your assets. For example, if you have some servers. DMZs, or different types of servers, such as core banking servers, you can apply the use cases to the targeted groups or the whole system.